Someone Is Pretending to Be Your Company by Email. What Can You Do?

A client recently asked us a familiar question: “Someone is sending emails pretending to be our company. How do we stop them?”

The concern is not only whether the company’s systems have been compromised. What happens if one of its clients falls for the scam, sends money to the attacker and then blames the company?

That can damage a client relationship even when the attacker never accessed your email or systems.

Unfortunately, there is no single setting that prevents every form of email impersonation. The first step is determining exactly how the attacker is pretending to be you.

How Does Email Impersonation Happen?

1. Domain Spoofing: Are They Using Your Actual Domain?

Suppose your company uses yourcompany.com.

An attacker may try to send an email that appears to come from accounting@yourcompany.com, even though they do not own the domain or have access to your email system.

This is called domain spoofing, and DMARC is designed to help prevent it.

DMARC is an email authentication standard that tells receiving email systems what to do when someone sends a message using your domain without authorization. When it is properly configured and enforced, those messages can be quarantined or rejected.

DMARC can also provide reporting that shows how email is being sent using your domain name. Those reports can be difficult to compile and interpret on their own, so making practical use of them usually requires a paid third-party DMARC reporting tool. Hungerford Technology can help provide and manage that reporting as part of our services.

That reporting helps show where mail using your domain is coming from, whether your domain is being spoofed, and whether legitimate email is failing DMARC for any reason. Once you know your legitimate email is passing DMARC consistently, you can be more confident about tightening the policy from monitoring to quarantine or rejection.

A simple way to think about it:

DMARC helps prevent unauthorized email from using your company’s actual domain in the From address, and DMARC reporting helps you confirm whether that protection is working as expected.

That is important protection, but it only addresses one type of impersonation.

2. Lookalike Domains: What If the Domain Only Looks Like Yours?

Instead of using yourcompany.com, an attacker could register something similar:

• yourcornpany.com
• yourcompanyinc.com
• yourcompany-payments.com

DMARC on your real domain will not stop this. The attacker is sending from a different domain that they control, even if the difference is difficult for your client to notice.

This is generally called a lookalike or adjacent domain. Domain-monitoring services can help identify suspicious registrations, while good inbound email security may warn your own employees about domains that resemble yours.

You may also register especially obvious variations of your domain, but purchasing every possible spelling is not practical.

3. Display Name Spoofing: What If They Are Just Using Your Name?

An attacker may create an email account and set the display name to your company’s president, salesperson or accounts-payable contact.

The message might display “Greg Webb” or “Your Company Accounting,” but the underlying address belongs to the attacker.

DMARC does not prevent this because the attacker is not using your domain. Inbound impersonation protection can help identify these messages when they are sent to your employees, but it cannot control every email system used by your clients.

4. Compromised Accounts: What If the Message Came From a Real Account?

The most serious possibility is that the attacker gained access to a real employee mailbox.

In that case, the email may look completely legitimate. The sender’s name, address, signature and even previous conversation history may all be correct.

It may also pass DMARC because the message was sent through your legitimate email environment.

DMARC cannot solve an account compromise. That requires protections such as multifactor authentication, sign-in monitoring, strong access policies, threat detection and a clear incident-response process.

How Can You Protect Clients From Email Impersonation?

Establish Verification Procedures for Payment Requests

This is the frustrating part: you do not control your clients’ email security or how carefully every recipient reads a message.

However, you can make a successful scam less likely.

Establish a clear verification process for high-risk requests. Tell clients that your company will never change payment instructions solely through email, or that they should verify banking changes using a known phone number.

The process matters because even a well-written warning at the bottom of an email will not stop every scam. Your employees also need to follow the same verification rules when a client or vendor asks your company to change payment information.

If someone begins impersonating your company, communicate quickly with affected clients. Give them the attacker’s address or lookalike domain, explain what requests to watch for and provide a trusted way to verify messages.

What Should You Do If Someone Is Impersonating Your Company by Email?

When someone reports an email impersonating your company, ask for a copy of the message and determine:

• Did it use your exact domain?
• Did it use a similar-looking domain?
• Did it use an employee’s name with an unrelated address?
• Did it come from a real account that may have been compromised?

DMARC is essential protection for your domain, but it does not prevent every email that looks like it came from your company.

You cannot prevent every impersonation attempt. You can protect your actual domain, monitor for lookalikes, secure employee accounts and establish verification procedures that make it harder for an attacker to convince a client to send money or sensitive information.

Stay updated! Get tips and insights delivered to your inbox weekly by subscribing to our newsletter.

FAQs About Email Impersonation

Can someone send emails pretending to be my company without hacking us?

Yes. Attackers can impersonate your company without accessing your email accounts or internal systems. They may spoof your domain, register a similar-looking domain or use an employee’s name with an unrelated email address. These techniques can make fraudulent messages appear legitimate to your customers.

What is the difference between email spoofing and email impersonation?

Email impersonation is the broader practice of making an email appear to come from a trusted person or organization. Email spoofing is one technique used to accomplish this, often by falsifying the sender’s email address. Impersonation can also involve lookalike domains, misleading display names or compromised email accounts.

Does DMARC prevent email impersonation?

DMARC helps prevent unauthorized senders from spoofing your company’s actual email domain, but it does not stop every type of impersonation. Attackers can still use lookalike domains, misleading display names or compromised accounts. DMARC works best as part of a broader email security strategy.

What should I do if someone is sending fraudulent emails using my company’s name?

Start by obtaining a copy of the suspicious email, including its full message headers if possible. Determine whether the attacker used your actual domain, a lookalike domain, a misleading display name or a compromised account. Your next steps may include reviewing email authentication settings, securing accounts, notifying affected customers and investigating the fraudulent sender.

Can my business be held responsible if a customer falls for an impersonation scam?

Potentially, depending on the circumstances. Responsibility may depend on whether your systems were compromised, what security procedures were in place, contractual obligations and applicable laws. Businesses should establish clear payment verification procedures and consult qualified legal counsel if a fraudulent transaction results in a dispute.

How can a small business protect its email domain from spoofing?

Small businesses should properly configure SPF, DKIM and DMARC email authentication. DMARC reporting can help identify unauthorized sending activity and authentication problems. Once legitimate email sources are properly authenticated, businesses can move toward a stronger DMARC enforcement policy that instructs receiving systems to quarantine or reject unauthorized messages.